CVE-2020-7477

high-risk
Published 2020-03-23

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module 140NOE771x1 (Versions 7.0 and prior), Quantum processors with integrated Ethernet – 140CPU65xxxxx (all Versions), and Premium processors with integrated Ethernet (all Versions), which could cause a Denial of Service when sending a specially crafted command over Modbus.

Do I need to act?

-
0.54% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

140Noe77101 Firmware
140Noe77111 Firmware
Tsxh5744M Firmware
Tsxh5724M Firmware
Tsxp576634M Firmware
Tsxp57554M Firmware
Tsxp575634M Firmware
Tsxp57454M Firmware
Tsxp574634M Firmware
Tsxp573634M Firmware
Tsxp57304M Firmware
Tsxp57254M Firmware
Tsxp572634M Firmware
Tsxp57204M Firmware
Tsxp571634M Firmware
Tsxp57154M Firmware
Tsxp57104M Firmware
140Cpu65160 Firmware
140Cpu65260 Firmware

Affected Vendors

Schneider-Electric

References (2)

Vendor Advisory https://www.se.com/ww/en/download/document/SEVD-2020-070-02/
Vendor Advisory https://www.se.com/ww/en/download/document/SEVD-2020-070-02/
50
/ 100
high-risk
Severity 26/34 · High
Exploitability 2/34 · Minimal
Exposure 22/34 · High